test(acl): submit writes an INGEDIEND record, and records are readable back (refs #153)

Ports and failing tests for the ACL half of S-19b-2, ahead of the implementation.

Once the projection is sourced from Objecten (ADR-0028's stated direction), a submitted
registration has to exist in the register the moment the zaak is opened — otherwise
re-sourcing silently drops every INGEDIEND row, since today only approval writes a record.
So `OpenZaakAsync` gains a second write, and approval upserts that same record to
INGESCHREVEN.

The subscriber gets only an object URL on an `objecten` notification (the payload carries no
record data) and may not read Objecten itself (§8.1), so `IRegisterRecordGateway` gains a
read and `AclService` exposes it.

Red:
- AclService does not yet write on open → the record assertion fails on an empty list.
- ObjectenGateway.GetAsync is a shell throwing NotImplementedException; its tests pin the
  contract: fetch the object URL directly (no objecttype resolution, no search), the CRS
  header a geo API requires, static Token auth, and a 404 read as "nothing to project"
  rather than an error (§8.6).

services/acl/Acl.Application/AclService.cs

@@ -52,6 +52,18 @@ public sealed class AclService(
             ct);
     }
 
+    /// <summary>
+    /// The register record held by an object in Objecten, for the Event Subscriber (S-19b-2). The
+    /// subscriber gets only an object URL on the notification and may not read Objecten itself
+    /// (§8.1, ADR-0028), so the ACL reads it back.
+    /// </summary>
+    public Task<RegisterRecord?> GetRegisterRecordAsync(Uri objectUrl, CancellationToken ct = default)
+    {
+        ArgumentNullException.ThrowIfNull(objectUrl);
+
+        return register.GetAsync(objectUrl, ct);
+    }
+
     /// <summary>The zaak's UUID — the key the register record and the read projection rows share.</summary>
     private static string ZaakId(Uri zaakUrl) => zaakUrl.Segments[^1].TrimEnd('/');
 

services/acl/Acl.Application/IRegisterRecordGateway.cs

@@ -13,6 +13,14 @@ public interface IRegisterRecordGateway
     /// the existing object instead of creating a second one (§8.6).
     /// </summary>
     Task UpsertAsync(RegisterRecord record, CancellationToken ct = default);
+
+    /// <summary>
+    /// The register record held by the object at <paramref name="objectUrl"/>, or <c>null</c> if that
+    /// object holds none. The Event Subscriber projects a register write from the notification NRC
+    /// delivers, which carries only the object URL — so it reads the record back through the ACL
+    /// rather than talking to Objecten itself (§8.1, S-19b-2).
+    /// </summary>
+    Task<RegisterRecord?> GetAsync(Uri objectUrl, CancellationToken ct = default);
 }
 
 /// <summary>